Security Notes
Plain-English guidance for local businesses that don't have an IT department. Each note covers one thing you can do to make your business harder to break into, and shows when it was last reviewed.
-
Texts, calls and voices you shouldn't trust
Fake toll and delivery texts, calls from "your bank's fraud department," and AI-cloned voices: how they work, and one call-back rule that defeats them all.
Read the note -
Do you need a written security plan?
What a written information security plan is, which businesses are required to have one, Ohio's safe harbor, and what belongs in the plan.
Read the note -
Is your privacy policy telling the truth?
Your privacy policy makes promises about visitors' data. Trackers, pixels and cookies on your site can quietly break them. Here is how to check.
Read the note -
Stop criminals sending email as you
Three DNS records, SPF, DKIM and DMARC, decide whether criminals can send convincing email from your domain. Here is what each one does and how to set them up.
Read the note -
Turn on two-step login everywhere
The most effective step you can take this week: which accounts to protect first, which kind of second step to choose, and how to roll it out to your team.
Read the note -
Spot phishing and fake invoice scams
How today's phishing really looks, the change-of-bank-details scam that targets small businesses, and a simple payment rule that stops it.
Read the note -
Password managers for small teams
Why reused passwords are the real risk, how a password manager fixes it, and how to move a small team off the shared spreadsheet.
Read the note